Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Organic IDX plugin allows Remote Code Inclusion. This vulnerability affects versions through 5.2.0.
An unauthenticated attacker over the network can execute arbitrary code remotely through code injection, allowing them to compromise the affected system.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update the Realtyna Organic IDX plugin to a version newer than 5.2.0. Refer to for patch details and additional mitigation guidance.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD published the first details for CVE-2026-57811
A CVSS base score of 10 has been assigned.
Feedly found the first article mentioning CVE-2026-57811 . See article
GitHub Advisories released a security advisory .
[GHSA-h792-m9gx-73f2] Improper Control of Generation of Code ('Code Injection') vulnerability in Realt
Critical Code Injection Vulnerability in Realtyna Organic IDX Plugin Disclosed
CVE-2026-57811: WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability [CRITICAL]
CVE Daily Brief — 2026-07-13
CVE-2026-57811 - Exploits & Severity - Feedly
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
